gnumeric r16312 - in branches/gnumeric-1-8: . plugins/excel

[mortenw svn gnome org]

Author: mortenw
Date: Wed Jan 30 02:52:56 2008
New Revision: 16312
URL: http://svn.gnome.org/viewvc/gnumeric?rev=16312&view=rev

Log:
2008-01-29  Morten Welinder  <terra gnome org>

	* ms-excel-read.c (excel_read_EXTERNSHEET_v8): Check q->length
	properly.  Fixes #512984.



Modified:
   branches/gnumeric-1-8/NEWS
   branches/gnumeric-1-8/plugins/excel/ChangeLog
   branches/gnumeric-1-8/plugins/excel/ms-excel-read.c

Modified: branches/gnumeric-1-8/NEWS
==============================================================================
--- branches/gnumeric-1-8/NEWS	(original)
+++ branches/gnumeric-1-8/NEWS	Wed Jan 30 02:52:56 2008
@@ -3,6 +3,7 @@
 Morten:
 	* Fix loading of solver constraints.
 	* Fix solver issue.  [#512500]
+	* Fix corrupted-xls-file problem.  [#512984]
 
 --------------------------------------------------------------------------
 Gnumeric 1.8.1

Modified: branches/gnumeric-1-8/plugins/excel/ms-excel-read.c
==============================================================================
--- branches/gnumeric-1-8/plugins/excel/ms-excel-read.c	(original)
+++ branches/gnumeric-1-8/plugins/excel/ms-excel-read.c	Wed Jan 30 02:52:56 2008
@@ -5406,7 +5406,10 @@
 
 	XL_CHECK_CONDITION (importer->ver >= MS_BIFF_V8);
 	g_return_if_fail (importer->v8.externsheet == NULL);
+
+	XL_CHECK_CONDITION (q->length >= 2);
 	num = GSF_LE_GET_GUINT16 (q->data);
+	XL_CHECK_CONDITION (q->length >= 2 + num * 6);
 
 	d (2, fprintf (stderr,"ExternSheet (%d entries)\n", num););
 	d (10, gsf_mem_dump (q->data, q->length););